Blackbox security evaluation of chromecast network communications

Abstract

Chromecast is a small, system-on-chip device, that plugs into the HDMI port of a larger screen and turns it into a smart screen. It is designed for multimedia streaming in a home-network environment. By setting up Chromecast, you can stream videos onto a larger screen and control it from a mobile device such as a smart-phone, tablet or a laptop. We examined the network packets exchanged between the smaller remote control device and the Chromecast attached larger screen. While Chromecast encrypts most of the content, remote control device sends control packets to the remote servers in the clear-text, which makes it vulnerable to reply-attacks or session-hijacking attacks. Besides, data transmission pattern leak personal information outside of the home-network, raising privacy concerns. Network protocols used by Chromecast are investigated and known vulnerabilities are listed. A method to detect the existence of Chromecast behind a home-router is proposed.